The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The iterative loop relies on reading instructions from local files (next-prompt.md, SITE.md, DESIGN.md), which constitutes an attack surface for indirect prompt injection if those files are modified by untrusted sources or contain malicious instructions that the agent then follows in subsequent steps.
Ingestion points: The agent reads task definitions from next-prompt.md and project context from SITE.md and DESIGN.md in every loop cycle (SKILL.md Step 1 & 2).
Boundary markers: YAML frontmatter is used in the baton files to separate instructions from metadata, though this does not prevent instruction override within the prompt body.
Capability inventory: The agent possesses Bash, Write, and Read capabilities, along with MCP tool access for UI generation and browser automation (SKILL.md allowed-tools).
Sanitization: No specific sanitization or 'ignore instructions' delimiters are mandated for the content read from the project files.
[COMMAND_EXECUTION]: The skill involves the execution of shell commands through the Bash tool, specifically for starting a local development server via npx serve to perform visual verification of the generated site (SKILL.md Step 4.5).

stitch-loop